bexleyac.org.uk - urlscan.io

Summary

This website contacted 3 IPs in 1 countries across 3 domains to perform 3 HTTP transactions. The main IP is 35.246.78.175, located in Mountain View, United States and belongs to GOOGLE, US. The main domain is bexleyac.org.uk.
TLS certificate: Issued by Let's Encrypt Authority X3 on January 10th 2020. Valid for: 3 months.

This is the only time bexleyac.org.uk was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1	35.246.78.175 35.246.78.175	15169 (GOOGLE) (GOOGLE)
1	2606:4700:20:... 2606:4700:20::681a:cf5	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2 3	173.244.96.154 173.244.96.154	7799 (OLYPENASN) (OLYPENASN)
3	3

1 35.246.78.175 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: 175.78.246.35.bc.googleusercontent.com

bexleyac.org.uk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:20::681a:cf5 (United States)

ASN13335 (CLOUDFLARENET, US)

aframe.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 173.244.96.154 (Sequim, United States) 2 redirects

ASN7799 (OLYPENASN, US)
PTR: 173-244-96-154.olypen.com

campingbear.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	campingbear.com 2 redirects campingbear.com	859 B
1	aframe.io aframe.io	269 KB
1	bexleyac.org.uk bexleyac.org.uk	846 B
3	3

	Domain	Requested by
3	campingbear.com	2 redirects bexleyac.org.uk
1	aframe.io	bexleyac.org.uk
1	bexleyac.org.uk
3	3

This site contains no links.

Subject Issuer	Validity	Valid
*.bexleyac.org.uk Let's Encrypt Authority X3	`2020-01-10` - `2020-04-09`	3 months	crt.sh
sni.cloudflaressl.com CloudFlare Inc ECC CA-2	`2019-11-16` - `2020-10-09`	a year	crt.sh
campingbear.com cPanel, Inc. Certification Authority	`2020-03-04` - `2020-06-02`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://bexleyac.org.uk/wp-read/supp/index.php?m=patricia.samways@centerpointenergy.com
Frame ID: CDF19CC52C012D757FB0AD522BA62BF8
Requests: 2 HTTP requests in this frame

Frame: https://campingbear.com/portal/smb8xuogvnkuot3saxvk1w69.php?CbH85e1583530622854af37a145ab15c558bc7a497c58706854af37a145ab15c558bc7a497c58706854af37a145ab15c558bc7a497c58706854af37a145ab15c558bc7a497c58706854af37a145ab15c558bc7a497c58706&email=&error=
Frame ID: 44DFBA46A178B1C0FA1D3A10FDB5A58F
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

A-Frame (JavaScript Graphics) Expand

Overall confidence: 100%
Detected patterns

html /<a-scene[^<>]*>/i
script /\/?([\d.]+)?\/aframe(?:\.min)?\.js/i

three.js (JavaScript Graphics) Expand

Overall confidence: 100%
Detected patterns

html /<a-scene[^<>]*>/i
script /\/?([\d.]+)?\/aframe(?:\.min)?\.js/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

3
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

270 kB
Transfer

1083 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1

https://campingbear.com/portal HTTP 301
https://campingbear.com/portal/ HTTP 302
https://campingbear.com/portal/smb8xuogvnkuot3saxvk1w69.php?CbH85e1583530622854af37a145ab15c558bc7a497c58706854af37a145ab15c558bc7a497c58706854af37a145ab15c558bc7a497c58706854af37a145ab15c558bc7a497c58706854af37a145ab15c558bc7a497c58706&email=&error=

3 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request index.php Show response
bexleyac.org.uk/wp-read/supp/ 725 B
846 B 346ms
266ms Document
text/html 35.246.78.175
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://bexleyac.org.uk/wp-read/supp/index.php?m=patricia.samways@centerpointenergy.com
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.246.78.175 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 175.78.246.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 29d5201d173c0971cf4e0775f254dfd768f8d6ac0b3859c1c2b4c4c7a1151183

Request headers

:method: GET
:authority: bexleyac.org.uk
:scheme: https
:path: /wp-read/supp/index.php?m=patricia.samways@centerpointenergy.com
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: document
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: document

Response headers

status: 200
server: nginx
date: Fri, 06 Mar 2020 21:37:00 GMT
content-type: text/html; charset=UTF-8
host-header: b7440e60b07ee7b8044761568fab26e8
x-proxy-cache: MISS

GET
H2 200 aframe.min.js Show response
aframe.io/releases/0.7.1/ 1 MB
269 KB 82ms
25ms Script
application/javascript 2606:4700:20::681a:cf5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://aframe.io/releases/0.7.1/aframe.min.js
Requested by: Host: bexleyac.org.uk
URL: https://bexleyac.org.uk/wp-read/supp/index.php?m=patricia.samways@centerpointenergy.com
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:cf5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7ad5c207d145e67eea462732be66b7193e7f18d1b459373a39e2ed0a99380df1

Request headers

Referer: https://bexleyac.org.uk/wp-read/supp/index.php?m=patricia.samways@centerpointenergy.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Fri, 06 Mar 2020 21:37:00 GMT
content-encoding: br
cf-cache-status: HIT
age: 362
status: 200
last-modified: Wed, 05 Feb 2020 02:11:30 GMT
server: cloudflare
x-github-request-id: F6F6:0397:66071:8956E:5E3D2838
etag: W/"5e3a2452-10ea12"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
expires: Fri, 06 Mar 2020 21:15:23 GMT
cache-control: max-age=14400
cf-ray: 56ff372bd8ac97a8-FRA
x-proxy-cache: HIT

GET
H/1.1

200
OK

smb8xuogvnkuot3saxvk1w69.php
campingbear.com/portal/ Frame 44DF
Redirect Chain

https://campingbear.com/portal
https://campingbear.com/portal/
https://campingbear.com/portal/smb8xuogvnkuot3saxvk1w69.php?CbH85e1583530622854af37a145ab15c558bc7a497c58706854af37a145ab15c558bc7a497c58706854af37a145ab15c558bc7a497c58706854af37a145ab15c558bc7a49...

0
0

210ms
210ms

Document
text/html

173.244.96.154
OLYPENASN

General

Check archive.org

Show headers Download Go to

Full URL

https://campingbear.com/portal/smb8xuogvnkuot3saxvk1w69.php?CbH85e1583530622854af37a145ab15c558bc7a497c58706854af37a145ab15c558bc7a497c58706854af37a145ab15c558bc7a497c58706854af37a145ab15c558bc7a497c58706854af37a145ab15c558bc7a497c58706&email=&error=

Requested by

Host: bexleyac.org.uk
URL: https://bexleyac.org.uk/wp-read/supp/index.php?m=patricia.samways@centerpointenergy.com

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

173.244.96.154 Sequim, United States, ASN7799 (OLYPENASN, US),

Reverse DNS

173-244-96-154.olypen.com

Software

nginx /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Host: campingbear.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Referer: https://bexleyac.org.uk/wp-read/supp/index.php?m=patricia.samways@centerpointenergy.com
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://bexleyac.org.uk/wp-read/supp/index.php?m=patricia.samways@centerpointenergy.com

Response headers

Server: nginx
Date: Fri, 06 Mar 2020 21:37:02 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-Nginx-Cache-Status: MISS
X-Server-Powered-By: Engintron
Content-Encoding: gzip

Redirect headers

Server: nginx
Date: Fri, 06 Mar 2020 21:37:02 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Connection: keep-alive
Location: smb8xuogvnkuot3saxvk1w69.php?CbH85e1583530622854af37a145ab15c558bc7a497c58706854af37a145ab15c558bc7a497c58706854af37a145ab15c558bc7a497c58706854af37a145ab15c558bc7a497c58706854af37a145ab15c558bc7a497c58706&email=&error=
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-Nginx-Cache-Status: MISS
X-Server-Powered-By: Engintron

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

16 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://aframe.io/releases/0.7.1/aframe.min.js(Line 388) Message: A-Frame Version: 0.7.1 (Date 18-10-2017, Commit #b9a751e)
console-api	log	URL: https://aframe.io/releases/0.7.1/aframe.min.js(Line 388) Message: three Version: ^0.87.0
console-api	log	URL: https://aframe.io/releases/0.7.1/aframe.min.js(Line 388) Message: WebVR Polyfill Version: ^0.9.36

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aframe.io
bexleyac.org.uk
campingbear.com
173.244.96.154
2606:4700:20::681a:cf5
35.246.78.175
29d5201d173c0971cf4e0775f254dfd768f8d6ac0b3859c1c2b4c4c7a1151183
7ad5c207d145e67eea462732be66b7193e7f18d1b459373a39e2ed0a99380df1

bexleyac.org.uk Open in urlscan Pro 35.246.78.175 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

3 Requests

100 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

3 IPs

1 Countries

270 kBTransfer

1083 kBSize

0 Cookies

0 Outgoing links

Redirected requests

3 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

16 JavaScript Global Variables

0 Cookies

3 Console Messages

Indicators

bexleyac.org.uk Open in urlscan Pro
35.246.78.175 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

3
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

270 kB
Transfer

1083 kB
Size

0
Cookies

3 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!